logo

Database

Business information leak In mlflow

Description

Information exposure in MLflow An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-434722. NVD-2023-434723. OSV-2023-434724. GCVE-2023-43472

References

1. https://mlflow.org/news/2023/12/06/2.9.0-release/index.html2. https://www.contrastsecurity.com/security-influencers/discovering-mlflow-framework-zero-day-vulnerability-machine-language-model-security-contrast-security3. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43472.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.